Short answer: If HIPAA covers your clinic, a patient’s photo, name or story can go on social media only with their written authorization. Full-face photos are among the details that identify a patient. The FTC adds rules for results claims and for staff who post about the clinic.
Before you read: This guide explains what HHS, the FTC and Meta publish about a clinic’s posts. It is general information, not legal advice. For your specific case, talk to your attorney or your compliance lead.
When HIPAA applies to a clinic
The HIPAA Rules apply to covered entities and business associates, HHS says. Covered entities include health care providers such as doctors and clinics.
A provider counts only if it transmits information electronically in connection with a transaction for which HHS has adopted a standard. If a clinic doesn’t meet the definition, it doesn’t have to comply with the HIPAA Rules.
HHS has a question and answer decision tool to check. In our reading, a cosmetic clinic that patients pay directly should run it, or ask its attorney, before it assumes HIPAA doesn’t apply.
The FTC rules later in this guide work differently. “Truth in advertising is important in all media”, the FTC says, social media included. In our reading, they apply whether or not HIPAA covers your clinic.
Patient photos and testimonials need written authorization
With limited exceptions, HIPAA requires a patient’s written authorization before their health information is used or disclosed for marketing. HHS defines marketing as a communication about a product or service that encourages people to buy or use it.
Photos can identify a patient. Among the details that do, HHS lists full-face photographs and any comparable images, names, and any other unique identifying characteristic.
HHS settled with a physical therapy practice in the Los Angeles area that had posted patient testimonials on its website. They included full names and full-face photos, and the practice had no valid HIPAA authorizations.
What a clinic might post, and what the rules say
| Post | What the rules say | Our advice |
|---|---|---|
| Before-and-after photos | Marketing with a patient’s health information needs their written authorization (HHS) | Ask for it when you take the photos, not after the result |
| Patient testimonials | An HHS case involved testimonials with full names and photos posted without authorization | Keep each signed form with the date of the post |
| A result in a caption | “Results not typical” doesn’t change how a specific result is read (FTC) | Say what results patients generally get |
| Staff sharing posts | Employees who promote your services should disclose that they work for you (FTC) | Give staff a short line to copy, such as “my employer’s” |
| Boosted posts | Ads for cosmetic procedures must target people 18 or older (Meta) | Set the age before you boost a post |
The middle column sums up HHS, FTC and Meta guidance; the advice is ours.
How to get a patient’s authorization for a post
- Ask the patient, before you take photos for marketing, whether they agree to their use online.
- Write the authorization in plain language.
- Describe the photos and information you will use, in a specific way.
- Name who may use them and who may receive them, and describe each purpose, such as posts on your clinic’s Instagram account.
- Set an expiration date or an expiration event.
- Have the patient sign and date it, and tell them they can revoke it in writing.
- Keep the signed form on file and post only what it covers.
Steps 2 to 6 come from the HIPAA rule on authorizations, 45 CFR 164.508, and steps 1 and 7 are ours. The rule asks for more required statements, so have your attorney or compliance lead review your form.
Results, testimonials and staff posts
A post that shows one patient’s result will usually be read as what others can expect. Lines like “Results not typical” or “Individual results may vary” don’t change that, the FTC says.
Either have proof that the results shown are typical, or clearly disclose the results patients can generally expect in those circumstances.
Staff posts count too. When employees share a post that promotes your services, they should disclose that they work for you. The FTC says “#employee” alone won’t be understood, while words like “my employer’s” are clearer.
Set a written policy and remind staff of it from time to time. If you actively ask employees to write reviews, the FTC says you are responsible for monitoring them. Relatives and friends who post should say so, too.
Replies, creators and boosted posts
Replies to comments and reviews need the same care. Our guide to Google Business Profile for doctors covers how to answer patient reviews, including the HHS cases about replies.
If you pay a creator to post about the clinic, the creator should disclose the payment, the FTC says. Our guide to Instagram collab posts covers posting together on one account.
A boosted post is an ad. Meta requires ads for cosmetic products, procedures or surgeries to target people 18 or older. With that targeting, ads can show before and after transformations.
Our guide to boosting a post on Facebook shows where you set the audience. Meta also bars cosmetic ads with statements that attack someone’s appearance, body parts or hygiene. Our guide to Facebook ad copy covers the rest of what an ad can say.
Check these before a patient appears in a post
- You know whether HIPAA covers your clinic.
- The patient signed and dated an authorization that covers this post.
- The caption doesn’t present an exceptional result as typical.
- Staff and relatives who share it say how they’re connected.
- No reply confirms that someone is a patient.
- Any boost targets people 18 or older.
RememberIf HIPAA covers your clinic, a patient’s written authorization comes before their photo or story goes online. The FTC asks you to show typical results and to disclose staff connections.
If you’d rather hand off the posting, our social media management service plans, designs and posts on your Facebook, Instagram and TikTok, in English and Spanish, for businesses in Miami-Dade.
Common questions about HIPAA and social media
Can a clinic post before-and-after photos on Instagram?
Yes, with care. If HIPAA covers your clinic, you need the patient’s written authorization before you use their photos for marketing. The FTC also expects the post to show results patients can generally expect. If you boost it, Meta requires an audience of people 18 or older.
Is a photo without the face still protected?
It can be. HHS lists full-face photographs and any comparable images among the details that identify a patient. Names, dates such as a birth date (all but the year), and any other unique identifying characteristic count too. Our advice is to get the authorization for every patient photo you post.
Does HIPAA apply to a cosmetic clinic that patients pay directly?
It depends. A health care provider is a covered entity only if it transmits information electronically in connection with a transaction for which HHS has adopted a standard. HHS has a decision tool to check, and your attorney can confirm it. In our reading, the FTC rules apply either way.
Can employees post about the clinic on their own accounts?
Yes, but they should say they work for you when the post promotes your services. The FTC says “#employee” alone isn’t clear, while words like “my employer’s” in the text are. Put this in a written policy and remind staff of it from time to time.
Is “Individual results may vary” enough under a result?
No. The FTC says lines like “Results not typical” or “Individual results may vary” don’t change how people read a specific result. Either have proof that the results shown are typical, or clearly disclose the results patients can generally expect.
Sources
Sources read on November 6, 2026. From HHS: Marketing, Covered Entities and Business Associates, Guidance Regarding Methods for De-identification of Protected Health Information and Physical therapy provider settles violations that it impermissibly disclosed patient information. From the eCFR: 45 CFR 164.508, Uses and disclosures for which an authorization is required. From the FTC: FTC’s Endorsement Guides: What People Are Asking. From Meta’s Advertising Standards: Health and Wellness.